Activation security

On receiving a publishing/activation request, a Magnolia public instance authenticates the author instance using a public key. The author instance generates the key automatically on first publishing/activation of content and transfers it to the public instance. You can generate new public keys any time on the author instance. A single public key is used for multiple public instances.

Configuration

The authentication mechanism requires no configuration. The public key is generated automatically on the first activation of content and transferred to the public instance. The configuration of activation is stored in the server :

Configuration with the Publishing module in use:

Configuration with the Activation module in use:

The key pair is also stored on the local file system. If you use the default Magnolia bundle, the location is configured in a magnolia.properties file.

# Location of the file containing both the private and the public keys used to verify authenticity of activation requests
# This file is generated if not present
magnolia.author.key.location=${magnolia.home}/WEB-INF/config/default/magnolia-activation-keypair.properties

Generating a new public key

You can create a new public key in the Publishing Tools app (shown in the screenshot below) or the older Activation Tools app, depending on which module you are using. Key lengths from 512 to 1024 bits are possible.

To generate a new public key:

1. On the author instance, open the app in the TOOLS group:
   
2. Click Generate new key. This generates a new public key and registers it automatically on the author instance.
3. Copy the new key from the Current public key box.
4. Sign into the public instances and open the Configuration app. 
5. Paste they key to Configuration > /server/activation/publicKey .

Troubleshooting

Any type of misconfiguration related either to the keys themselves or the handshaking process between the author and the public instance(s) may lead to activation errors.

Example:

SEVERE: Servlet.service() for servlet [default] in context with path [/magnoliaPublic] threw exception
org.bouncycastle.crypto.DataLengthException: input too large for RSA cipher.
	at org.bouncycastle.crypto.engines.RSACoreEngine.convertInput(Unknown Source)
	at org.bouncycastle.crypto.engines.RSABlindedEngine.processBlock(Unknown Source)
	at org.bouncycastle.jcajce.provider.asymmetric.rsa.CipherSpi.getOutput(Unknown Source)
	at org.bouncycastle.jcajce.provider.asymmetric.rsa.CipherSpi.engineDoFinal(Unknown Source)
	at javax.crypto.Cipher.doFinal(Cipher.java:2168)
	at info.magnolia.cms.security.SecurityUtil.decrypt(SecurityUtil.java:168)
	at info.magnolia.cms.security.SecurityUtil.decrypt(SecurityUtil.java:131)
	at info.magnolia.publishing.authentication.DefaultPrivatePublicKeyAuthenticator.authenticate(DefaultPrivatePublicKeyAuthenticator.java:92)